fix(workflow): preserve formal release state

.github/workflows/build-v3.yml

@@ -543,6 +543,8 @@ jobs:
               --repo "$GITHUB_REPOSITORY" \
               --title "$tag_name" \
               --notes-file "$notes_file" \
+              --draft=false \
+              --prerelease=false \
               --latest
           else
             gh release create "$tag_name" \

docs/architecture-optimization-checklist.md

@@ -78,7 +78,7 @@ MoviePilot V3 已经形成较清晰的模块化单体：`foundation`、`domain`
 | Python 源码量 | 约 271,400 行 | 60 个文件超过 1,000 行，14 个超过 2,000 行 |
 | 长方法 | 281 个超过 80 行 | 67 个超过 150 行，23 个超过 250 行；大量是私有方法 |
 | 全量 mypy 历史债务 | 11,808 / 596 文件 | strict frontier 当前覆盖 41 个文件，本批迁移路径的类型债务已清零 |
-| Ruff 历史诊断 | 869 | 低水位门禁通过，但规则集只覆盖 `E4/E7/E9/F/I` |
+| Ruff 历史诊断 | 868 | 低水位门禁通过，但规则集只覆盖 `E4/E7/E9/F/I` |
 | 覆盖率低水位 | Application 79.02%，Domain 79.29% | Chain、Runtime、Agent、Adapter、Startup 未进入包级覆盖率门禁 |
 
 ### 3.3 热点文件

docs/architecture-refactor-roadmap.md

@@ -153,7 +153,7 @@ canonical 主程序；兼容只经统一 Compat/SDK 门面提供。
 | S4-L2 Event strict contract | `PLANNED` | S0-L2.6,S1-L6 | 宿主事件输入/输出按风险 strict，诊断例外只属于第三方插件兼容 |
 | S4-L3 Complexity v2 | `PLANNED` | S3 | 私有方法、class/file、圈复杂度进入门禁；所有超限通过职责拆分归零 |
 | S4-L4 全量 mypy 清零 | `PLANNED` | S3,S4-L1,S4-L2 | `mypy-baseline.json` 归零并删除债务接受路径，全宿主 strict 类型通过 |
-| S4-L5 Ruff 治理债务清零 | `PLANNED` | S3 | 当前受控 869 条诊断归零，规则集扩展经过独立审查且新增诊断为零 |
+| S4-L5 Ruff 治理债务清零 | `PLANNED` | S3 | 当前受控 868 条诊断归零，规则集扩展经过独立审查且新增诊断为零 |
 | S4-L6 Coverage/并发/质量证据 | `PLANNED` | S3,S4-L1,S4-L2 | 高风险包纳入 coverage；raw concurrency 分类清零；Module Quality 有真实 evidence test |
 
 ### S5：Plugin、Agent、Domain、Startup 与最终收口

tests/test_release_supply_chain.py

@@ -1,6 +1,7 @@
 """正式镜像发布的供应链门禁合同。"""
 
 import os
+import shutil
 import subprocess
 from datetime import date
 from pathlib import Path
@@ -79,6 +80,9 @@ def _run_release_script(
     extra_env: dict[str, str] | None = None,
 ) -> subprocess.CompletedProcess[str]:
     """在隔离的 gh 替身环境中执行发布 workflow 脚本。"""
+    bash = shutil.which("bash")
+    if bash is None:
+        pytest.skip("release workflow contract requires Bash")
     response_file = tmp_path / "response.txt"
     error_file = tmp_path / "error.txt"
     response_file.write_text(response, encoding="utf-8")
@@ -99,7 +103,7 @@ def _run_release_script(
     )
     env.update(extra_env or {})
     return subprocess.run(
-        ["/bin/bash", "-euo", "pipefail", "-c", script],
+        [bash, "-euo", "pipefail", "-c", script],
         cwd=tmp_path,
         env=env,
         capture_output=True,
@@ -305,6 +309,8 @@ def test_release_uses_github_cli_for_tag_and_release_lifecycle() -> None:
     assert "gh release edit" in publish_release
     assert "gh release create" in publish_release
     assert '--notes-file "$notes_file"' in publish_release
+    assert "--draft=false" in publish_release
+    assert "--prerelease=false" in publish_release
     assert "--latest" in publish_release
     names = [step.get("name") for step in workflow["jobs"]["Docker-build"]["steps"]]
     assert names.index("Get existing release body") < names.index("Publish Release Tag")
@@ -378,6 +384,9 @@ def test_release_publish_selects_edit_or_create(
     assert result.returncode == 0, result.stderr
     log = (tmp_path / "gh.log").read_text(encoding="utf-8")
     assert expected_command in log
+    if release_exists == "true":
+        assert "--draft=false" in log
+        assert "--prerelease=false" in log
 
 
 def test_dependency_compat_checks_minimum_uv_version() -> None: